AZL-52284 CVE-2024-49954 affecting package kernel for versions less than 5.15.173.1-1

In the Linux kernel, the following vulnerability has been resolved: staticcall: Replace pointless WARNON in staticcallmodulenotify staticcallmodulenotify triggers a WARNON, when memory allocation fails in staticcalladdmodule. That's not really justified, because the failure case must be correctly...

DEBIAN-CVE-2024-49933

In the Linux kernel, the following vulnerability has been resolved: blkiocost: fix more out of bound shifts Recently running UBSAN caught few out of bound shifts in the iocforgivedebts function: UBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38 shift exponent 80 is too large for 64-bit typ...

UBUNTU-CVE-2024-49987

In the Linux kernel, the following vulnerability has been resolved: bpftool: Fix undefined behavior in qsortNULL, 0, ... When netfilter has no entry to display, qsort is called with qsortNULL, 0, .... This results in undefined behavior, as UBSan reports: net.c:827:2: runtime error: null pointer...

UBUNTU-CVE-2024-49888

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a sdiv overflow issue Zac Ecob reported a problem where a bpf program may cause kernel crash due to the following error: Oops: divide error: 0000 1 PREEMPT SMP KASAN PTI The failure is due to the below signed divide:...

CVE-2024-49987 bpftool: Fix undefined behavior in qsort(NULL, 0, ...)

In the Linux kernel, the following vulnerability has been resolved: bpftool: Fix undefined behavior in qsortNULL, 0, ... When netfilter has no entry to display, qsort is called with qsortNULL, 0, .... This results in undefined behavior, as UBSan reports: net.c:827:2: runtime error: null pointer...

CVE-2024-49987 bpftool: Fix undefined behavior in qsort(NULL, 0, ...)

In the Linux kernel, the following vulnerability has been resolved: bpftool: Fix undefined behavior in qsortNULL, 0, ... When netfilter has no entry to display, qsort is called with qsortNULL, 0, .... This results in undefined behavior, as UBSan reports: net.c:827:2: runtime error: null pointer...

MAL-2024-9453 Malicious code in mybasicauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9f167c8091f34ef534b8a4fd6d46f2f09c2a268673734c1a7cf37a1ab4218153 The OpenSSF Package Analysis project identified 'mybasicauth' @ 1.0.13 npm as malicious. It is considered malicious because: - The package...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from possible undefined behavior of bpftool in the use of qsort...

Permissive Regular Expression in tacquito

Impact The CVE is for a software vulnerability. Network admins who have deployed tacquito or versions of tacquito in their production environments and use tacquito to perform command authorization for network devices should be impacted. Tacquito code prior to commit...

AlmaLinux 9 : webkit2gtk3 (ALSA-2024:8180)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:8180 advisory. webkitgtk: webkit2gtk: Use after free may lead to Remote Code Execution CVE-2024-40776 webkitgtk: webkit2gtk: Processing maliciously crafted web content m...

CVE-2024-47187

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash table behavior. This can lead to dataset file loading to us...

DEBIAN-CVE-2024-47187

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash table behavior. This can lead to dataset file loading to us...

DEBIAN-CVE-2024-47188

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to byte-range tracking having predictable hash table behavior. This can lead to an attacker...

CVE-2024-47187 Suricata datasets: missing hashtable random seed leads to potential DoS

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash table behavior. This can lead to dataset file loading to us...

CVE-2024-47187 Suricata datasets: missing hashtable random seed leads to potential DoS

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash table behavior. This can lead to dataset file loading to us...

K000141479: Wget vulnerability CVE-2024-38428

Security Advisory Description url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent...

Important: Red Hat Security Advisory: webkit2gtk3 security update

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

ALSA-2024:8180 Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: webkitgtk: webkit2gtk: Use after free may lead to Remote Code Execution CVE-2024-40776 webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash...

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: webkitgtk: webkit2gtk: Use after free may lead to Remote Code Execution CVE-2024-40776 webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash...

Suricata 安全特征问题漏洞

Suricata is a network IDS, IPS and NSM engine from the Open Information Security Foundation. A security signature issue vulnerability exists in Suricata versions prior to 7.0.7, which stems from a lack of initialization of the "thash" random seed, which results in byte range tracking with...